Verifying employees' bank detail changes
How a payroll bureau should verify a change to an employee's bank account before paying into it, and how Achekam keeps unverified accounts out of payment.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
The e-mail looks routine. It comes from a client's HR address two days before payday, says that one of the warehouse supervisors has changed banks, and asks the bureau to update the account before this month's run. The attachment is a neat letter with a logo. The payroll clerk updates the record, the run goes out, and a few weeks later the supervisor phones to ask where his salary went.
Of all the ways to steal from a payroll, redirecting one employee's net pay is among the simplest. It needs no access to the payroll system, only a convincing message to someone who has access. A bureau is an attractive target because it handles many employers, receives instructions by e-mail as a matter of course, and is usually busiest exactly when a fraudster wants it to be rushed.
Why the bank account is the weak point
Most payroll controls protect the calculation: who prepared the run, who approved it, whether the tax table was right. A changed bank account passes through all of those untouched. The gross pay is correct, the PAYE is correct, the payslip is correct. Only the destination of the money is wrong, and nobody notices until the employee does.
The same pattern appears on the purchasing side, where a "supplier" announces new banking details. ICAEW's note on how to identify and deal with fake invoices describes the warning signs and the preventive controls, among them segregation of duties and verifying bank-detail changes. The control a bureau needs for employees is the same in principle: a change of account is never accepted on the strength of the message that announces it.
Entered by one person, verified by another
Achekam applies that principle in the payroll itself, in South Africa, Nigeria and Kenya alike. An employee's bank account that one person enters or changes must be verified by another person before it is paid, whether through the payment schedule or a bank file.
Two points matter for a bureau's staffing:
- The verifier must be a different person. A single payroll clerk cannot both capture and verify a new account, however senior.
- Verification is a decision, not a click. The second person is confirming that the change is genuine. If they have not done anything to establish that, the control exists on paper only.
On South African payroll, only the Partner, Admin, Payroll, PayrollAdmin and FinanceManager roles can change payroll at all, which keeps the number of people who can touch bank details small.
Requests that come through self-service
Some employees request the change themselves. A staff member whose login is linked to their payroll record can submit a new bank account through self-service for payroll to decide. That is safer than an e-mail, because the request comes from the employee's own sign-in rather than an inbox anyone can spoof.
It is still not the end of the check. An approved bank change from self-service still needs a second person to verify it before it is paid. Self-service tells you who asked; verification confirms that the person who asked is the employee and that the account is theirs.
Unverified accounts are left out of payment
What happens if the run is approved while a change is still waiting? On South African payroll, unverified bank accounts are listed at approval and left off the bank file. The bureau produces the file, FNB's CSV template or a CSV in the column order the firm has set up for its bank, and the client or bureau imports it into online banking. Achekam does not pay anyone.
For Nigerian and Kenyan employers no bank-file layout ships, and every payment in a bank file needs a six-digit branch code. Their approved runs have a payment schedule downloadable as CSV instead, and marking it paid only records the fact; Achekam moves no money. The verification rule applies to the schedule in the same way.
The listing at approval is useful in itself. A run with an unverified account the week before payday is exactly the situation a fraudster creates, so the approver should treat each entry on that list as a question, not an inconvenience.
Confirming with the employee by another channel
The verifier's job is to reach the real employee by a route the requester does not control. A checklist the bureau can adopt for every change:
- Do not use contact details from the request. Call the employee on the number already held on the payroll record, or ask the client's line manager to speak to them in person.
- Ask the employee to confirm the account themselves, not simply to say yes to the number you read out.
- Ask for a bank confirmation of the account holder's name where the client's policy requires it, and check that the name matches the employee.
- Be suspicious of timing. A change received just before cut-off, marked urgent, deserves more checking, not less.
- Check for repeats. Two employees moving to the same account, or an account that matches a supplier or another employee, is a red flag.
- Record what was done: who verified, how, when, and with whom they spoke.
If verification cannot be completed before the run, leave the old account in place or leave the payment out, and tell the client why. A late salary can be paid tomorrow; a misdirected one may never come back.
Bringing it together in the bureau
The control works best when everyone knows their part. Clients should know that the bureau will not act on an e-mailed bank change alone. Bureau staff should know that verification means reaching the employee independently. Approvers should read the unverified list before every approval.
The wider division of duties, who prepares, who approves and how many people each client needs, is covered in splitting pay run preparation and approval. For South African employers, the file that carries verified accounts to the bank is explained in the wages bank file.
Write the bank-change procedure into each client's engagement terms this month, so that the first time a client hears "we need to confirm that with the employee" is not the day before payday.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
